Welcome!

@CloudExpo Authors: Mauro Carniel, William Schmarzo, Mehdi Daoudi, Pat Romanski, Elizabeth White

Related Topics: @CloudExpo, Java IoT, Microservices Expo, Containers Expo Blog, Machine Learning , Agile Computing

@CloudExpo: Article

Do You Want to Know What You Don’t Know?

Don't be a company paralyzed by the status quo

In my experience there are two types of enterprise IT departments: those that maintain the status quo and those looking to continuously explore and improve.

It is truly unfortunate how many fall into the former category.  But the problem with IT security is that it's an ever-evolving and moving target. So the decision to not dip your toe in the water and understand all available options could mean the difference between a panicked 3am call regarding a breach alert or a good night’s sleep.

I realize this is an over generalization, and oftentimes the decision to “stay the course” is not in the hands of IT. There are budget concerns. There are personnel limitations. There are higher perceived priorities. There are complex layers of interdepartmental decision making. So, if it ain’t broke, don’t fix it…right?

As an IT professional myself, I realize how inundated your inbox and voice mail becomes with messages; cloud-this, virtual-that, next generation so & so…but why rock the boat, everything is working…AS FAR AS YOU KNOW.

There’s the old adage, if you don’t know what you don’t know then you can’t possibly be prepared. Additionally there are organizations that simply act like ostriches. They put their head in the sand, so therefore nothing bad can happen. Or then there’s the old chestnut, “well, we’ve never been breached/hacked/attacked before, so there is no need to change.” These are people who don’t know what they don’t know…or don’t want to know because it will force a change of the status quo.

For them, here’s a true story.

Once upon a time there was (and still is!) a large retail and design firm worth about 3/4s of a billion dollars. They were very vigilant with their security. At least they thought so. They had solid on-premise tools and had dedicated security resources.  Problem was, with the lingering effects of the recession, budgets got squeezed and resources became scarcer. And looking at cost centers, IT security had a target on its back.  This prompted the IT team to investigate alternative ways to drive down costs, but still maintain the level of readiness and watchfulness.

They examined a variety of alternatives and did significant due diligence. They found that by moving their SIEM and Log Management functions to the cloud, they would remove considerable capital expenditures and related costs. For practically the same cost they were paying for on premise solution support and maintenance, they could incorporate a cloud-managed enterprise-class solution to manage their network defenses. But this isn’t an economic parable.

Working in conjunction with the new cloud-based security experts, the folks at this retail organization recreated many of the rules, alerts, and escalations against a variety of servers and endpoints currently being monitored on the on-premise system. For the first month or so, they wanted systems to be redundant--just to ensure the new cloud-managed SIEM and Log management were catching all the activity and traffic required to help protect the IP and help the organization comply with PCI and SOX.

Ten days into the project, the phone rang.  The cloud security analyst wanted to inform the company that some unusual anomalies were detected on an internal server. It was initially diagnosed as a false positive, but the cloud analyst insisted that when correlated with other data from other servers, the intrusion was probably more than just a harmless blip.

The company reviewed its on-premise logs and could not verify the same problem. At this point the analyst was able to provide the precise server and trace the issue to a specific laptop. It was there they found the unauthorized download of what seemed to be a harmless email application, but had also nested some nasty botnets and malware. Acting quickly, they were able to quarantine the problem and diffuse the issue before a breach could occur.

But the story is not so much about cloud security saving the day, but rather how a new way of thinking and analyzing shined a light on inefficiencies, unexplored vulnerabilities and process breakdowns. It provided updated knowledge on how their users and customers were accessing and using their network resources.

Again, the moral of the story is not that cloud security is superior to all other security implementations, but rather if you don’t know what you don’t know, you can’t make the necessary adjustments to create new best practices and, in short, do the job better and more efficiently. However, whereas cloud-based security may not be better than other enterprise deployments, it IS more accessible to companies that aren’t listed on the Fortune 500. Therefore, if it is AS GOOD as a brand name enterprise tool, it would be considerably more effective than most initiatives deployed by the smaller and more moderately financed enterprises.

It allows these companies to know what they don’t know. It allows them to cast a wider net around their IT assets and better understand who is access what data and when. It allows them to monitor, in real time, all the events that are hitting every quarter of their IT infrastructure and make informed determinations based on situational context. Instead of phased, limited or partially deployed  security initiatives, companies benefit from a fully-powered, industrial-strength solution ready on Day 1. To further mix metaphors, think of it as an experienced geologist looking for oil. Generally, he knows what areas likely contain oil reserves. Additionally he knows what crude looks like.  Problem is, all he has is a trowel with which to search. So if the oil is not bubbling up to the top, it will go unnoticed and untapped. The geologist needs radar penetrating technology. He needs the means to reach the reserve; to understand and document the different strata of earth, detritus and bedrock. He needs a way to determine where the most advantageous position on the field for maximum yield lies. Without it, he’s bound to miss something.

But first, he has to know what he doesn’t know.

And before I let you go this week, I ask a favor. My company, CloudAccess is in the running for an cloud computing UP Award and I would welcome your support. Please vote for us: HERE

More Stories By Kevin Nikkhoo

With more than 32 years of experience in information technology, and an extensive and successful entrepreneurial background, Kevin Nikkhoo is the CEO of the dynamic security-as-a-service startup Cloud Access. CloudAccess is at the forefront of the latest evolution of IT asset protection--the cloud.

Kevin holds a Bachelor of Science in Computer Engineering from McGill University, Master of Computer Engineering at California State University, Los Angeles, and an MBA from the University of Southern California with emphasis in entrepreneurial studies.

@CloudExpo Stories
"Infoblox does DNS, DHCP and IP address management for not only enterprise networks but cloud networks as well. Customers are looking for a single platform that can extend not only in their private enterprise environment but private cloud, public cloud, tracking all the IP space and everything that is going on in that environment," explained Steve Salo, Principal Systems Engineer at Infoblox, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventio...
"Cloud Academy is an enterprise training platform for the cloud, specifically public clouds. We offer guided learning experiences on AWS, Azure, Google Cloud and all the surrounding methodologies and technologies that you need to know and your teams need to know in order to leverage the full benefits of the cloud," explained Alex Brower, VP of Marketing at Cloud Academy, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clar...
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
The question before companies today is not whether to become intelligent, it’s a question of how and how fast. The key is to adopt and deploy an intelligent application strategy while simultaneously preparing to scale that intelligence. In her session at 21st Cloud Expo, Sangeeta Chakraborty, Chief Customer Officer at Ayasdi, provided a tactical framework to become a truly intelligent enterprise, including how to identify the right applications for AI, how to build a Center of Excellence to oper...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...
In his session at 21st Cloud Expo, James Henry, Co-CEO/CTO of Calgary Scientific Inc., introduced you to the challenges, solutions and benefits of training AI systems to solve visual problems with an emphasis on improving AIs with continuous training in the field. He explored applications in several industries and discussed technologies that allow the deployment of advanced visualization solutions to the cloud.
Agile has finally jumped the technology shark, expanding outside the software world. Enterprises are now increasingly adopting Agile practices across their organizations in order to successfully navigate the disruptive waters that threaten to drown them. In our quest for establishing change as a core competency in our organizations, this business-centric notion of Agile is an essential component of Agile Digital Transformation. In the years since the publication of the Agile Manifesto, the conn...
"MobiDev is a software development company and we do complex, custom software development for everybody from entrepreneurs to large enterprises," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Large industrial manufacturing organizations are adopting the agile principles of cloud software companies. The industrial manufacturing development process has not scaled over time. Now that design CAD teams are geographically distributed, centralizing their work is key. With large multi-gigabyte projects, outdated tools have stifled industrial team agility, time-to-market milestones, and impacted P&L stakeholders.
"ZeroStack is a startup in Silicon Valley. We're solving a very interesting problem around bringing public cloud convenience with private cloud control for enterprises and mid-size companies," explained Kamesh Pemmaraju, VP of Product Management at ZeroStack, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Enterprises are adopting Kubernetes to accelerate the development and the delivery of cloud-native applications. However, sharing a Kubernetes cluster between members of the same team can be challenging. And, sharing clusters across multiple teams is even harder. Kubernetes offers several constructs to help implement segmentation and isolation. However, these primitives can be complex to understand and apply. As a result, it’s becoming common for enterprises to end up with several clusters. Thi...
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, and Brandon Crowfeather, Product Manager, at Vivint Smart Home, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"Codigm is based on the cloud and we are here to explore marketing opportunities in America. Our mission is to make an ecosystem of the SW environment that anyone can understand, learn, teach, and develop the SW on the cloud," explained Sung Tae Ryu, CEO of Codigm, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, discussed how by using ne...
Vulnerability management is vital for large companies that need to secure containers across thousands of hosts, but many struggle to understand how exposed they are when they discover a new high security vulnerability. In his session at 21st Cloud Expo, John Morello, CTO of Twistlock, addressed this pressing concern by introducing the concept of the “Vulnerability Risk Tree API,” which brings all the data together in a simple REST endpoint, allowing companies to easily grasp the severity of the ...
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, discussed how data centers of the future will be managed, how the p...
"NetApp is known as a data management leader but we do a lot more than just data management on-prem with the data centers of our customers. We're also big in the hybrid cloud," explained Wes Talbert, Principal Architect at NetApp, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
"We're focused on how to get some of the attributes that you would expect from an Amazon, Azure, Google, and doing that on-prem. We believe today that you can actually get those types of things done with certain architectures available in the market today," explained Steve Conner, VP of Sales at Cloudistics, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.